An AI agent was asked to retrieve historical hospital-bed statistics from a government website. But it ended up doing a lot more than that.

According to an OpenAI incident report, an internal research model encountered access restrictions, then retrieved server configuration and application files, obtained sensitive credentials, examined application code and found a way around authorization controls.

It then downloaded 24 years of statistics, along with information unrelated to its assignment.

It wasn't an isolated case. Recent OpenAI and Anthropic disclosures describe AI models exploiting software vulnerabilities, circumventing restrictions and accessing systems without authorization.

Most happened during testing or evaluations under conditions that don't reflect typical enterprise deployments. But they expose an increasingly relevant IT problem: What happens when an AI agent encounters a restriction and starts looking for another way around it?

And just as important: Would your company know if it happened?

 How AI agents bypass security controls

“Rogue AI” makes for a dramatic headline, but these systems didn't suddenly turn malicious. They crossed boundaries while trying to complete assigned tasks. Learn why leading AI companies, analysts and government officials are debating AI regulation measures in our TechEDGE article, “As AI Grows More Powerful, Should We Keep It in Check?”

Some of the behaviors that have been disclosed are striking.

Anthropic has seen similar behavior. In an October report on unintended model actions, the company disclosed that Claude models exploited a software flaw to execute commands on a server, worked around restrictions to obtain gated data, circumvented limits on web tools and submitted forms they weren't supposed to submit.

One case escaped the AI lab in a particularly unusual way.

During an evaluation, Claude Haiku 4.5 encountered a police department webpage about an unsolved homicide. It generated and submitted a fabricated tip. Anthropic said the model appeared to believe it was demonstrating how to complete the form rather than intentionally misleading police. Luckily, the submission was flagged as spam and never forwarded for investigation.

These incidents are different in important ways, but there's a common thread: The agent encountered something preventing it from completing a task and found another route.

That's exactly what enterprises want autonomous agents to do — until the thing standing in their way is an access control.

Why AI agents need enforceable access controls

AI agents are useful because they can act across systems. They can query databases, call APIs, manipulate files, write code and carry out multi-step workflows.

That makes identity and permissions much more important than when generative AI was primarily producing text. NIST is now examining how identification, authorization and auditing should work as AI agents gain access to more data, tools and applications.

The underlying principle is familiar: Telling an agent not to do something isn't the same as making sure it can't do it.

Microsoft recommends treating every AI agent as a “first-class principal,” with its own identity, explicitly assigned roles, tightly scoped permissions and approved tools.

Consider a financial agent authorized to reconcile transactions and issue customer credits of up to $100. If it decides a $2,000 credit is the fastest way to settle a dispute, the payment system should stop the transaction rather than relying on the agent to remember its instructions.

Business rules need to become enforceable controls.

How can IT teams detect unauthorized AI agent activity??

Stopping unauthorized actions is one problem. Knowing when they happen is another.

OpenAI's hospital-data incident happened on June 17. The company says it wasn't discovered until Aug. 13. Its unauthorized use of the cryptocurrency wallet occurred June 26 and wasn't discovered until Sept. 25.

Anthropic also expanded its monitoring after discovering unintended behavior and temporarily disabled live internet access for internal evaluations while strengthening security and monitoring controls.

For enterprise IT, this turns rogue-agent behavior into an observability problem as much as an AI-safety problem.

IT leaders need to know:

• Which agents are running.
• What identities they're using.
• Which systems and tools they can access.
• What they're doing once they get there.

Logging matters, too. Microsoft recommends end-to-end instrumentation of agent actions so organizations can reconstruct an incident, including the agent's identity, role, scope, resources accessed and actions taken.

Otherwise, an agent could cross a boundary without anyone realizing it.

When AI agents exceed their authorized permissions

IT leaders want AI agents that don't give up easily. If one approach fails, try another. That persistence is part of their value.

But an agent needs to distinguish between an obstacle it should work around and a restriction it should respect.

In another case, an OpenAI model updating a cryptocurrency application needed funds to deploy its work. It found a test wallet it hadn't been authorized to use and spent some of its funds. According to OpenAI's incident report, the model considered whether it had permission but decided the funds were acceptable to use because the recovery phrase was public and the tokens had no real monetary value.

The cryptocurrency isn't the important part. The agent found a resource it hadn't been given, decided for itself that using it was acceptable and kept going.

In an enterprise, that resource could be a cloud credential, production database, employee record or financial account.

AI agent governance: Match autonomy to risk

None of this means enterprises should put a human approval screen in front of everything an AI agent does. That would defeat much of the point of agentic automation.

Instead, autonomy should reflect the consequences of an action. Some examples include:

• Let an IT-support agent search documentation on its own. Put stronger controls around resetting privileged credentials.
• Let a coding agent write and test software. Don't assume it also needs production credentials.

The higher the potential consequence, the tighter the controls should be.

For IT leaders, that means thinking about three things together:

1. Authorization: What is the agent allowed to do?
2. Enforcement: What prevents it from doing more?
3. Detection: How quickly would the enterprise know if it tried?

The OpenAI and Anthropic incidents don't mean every enterprise AI agent is about to go rogue. Many occurred under unusual testing conditions. But they're exposing potential failure modes before agents become deeply embedded across business processes.

AI agents are designed to find ways to get things done. IT leaders need to make sure the systems around them know when to say no.